Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The ER Swiffy Insert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [swiffy] shortcode in all versions up to and including 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes ('n', 'w', 'h'). These attributes are extracted using extract() and directly interpolated into the HTML output without any escaping such as esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-22 | 1 | Disclosure1 |
| 2026-04-23 | 1 | Disclosure1 |
| 2026-04-25 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-4082-er-swiffy-insert-version-1-0-0-medium-vulnerability-proof-of-concept CVE-2026-4082 #WordPress plugin #vulnerability er-swiffy-insert #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post announces a Proof of Concept for CVE‑2026‑4082 with a link to the PoC page, but does not detail exploit code, active attacks, or a patch.
CVE-2026-4082 The ER Swiffy Insert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [swiffy] shortcode in all versions up to and including 1.0.0. This is due… https://www.cve.org/CVERecord?id=CVE-2026-4082
Post summary
The text announces that the ER Swiffy Insert WordPress plugin up to version 1.0.0 contains a stored XSS vulnerability via its shortcode, as documented in CVE-2026-4082.
CVE-2026-4082 Stored Cross-Site Scripting in ER Swiffy Insert Plugin for WordPress 1.0.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4082 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A notification of a stored XSS vulnerability in the ER Swiffy Insert Plugin for WordPress is provided, with links to vulnerability details and a vendor advisory.